https://www.paolomainardi.com/tags/sbom/Recent content in Sbom on Paolo MainardiHugoenSat, 24 Oct 2026 21:00:00 +0200https://www.paolomainardi.com/posts/drubom-next-gen-drupal-supply-chain-security/Sat, 24 Oct 2026 21:00:00 +0200https://www.paolomainardi.com/posts/drubom-next-gen-drupal-supply-chain-security/<h2 id="tldr"> TL;DR <a class="heading-link" href="#tldr" aria-label="Link to heading"> <span aria-hidden="true">#</span> </a> </h2> <p><strong><a href="https://www.drupal.org/project/drubom" class="external-link" target="_blank" rel="noopener">DruBOM</a></strong>, the Drupal module I created in 2023 to build a <strong>software bill of materials</strong> (SBOM), was almost abandoned. Between a Saturday morning and a Monday afternoon, AI agents rewrote it from scratch: no external binaries, an <strong>SPDX 3.0.1</strong> export, vulnerability checks, <strong>VEX</strong> decisions and a new admin interface. I steered, tested and decided every merge; the agents wrote the code. It is out as <a href="https://www.drupal.org/project/drubom/releases/1.0.0-beta2" class="external-link" target="_blank" rel="noopener">1.0.0-beta2</a>.</p>